Train a machine learning model using IP addresses and connection contexts

Abstract

According to examples, an apparatus may include a processor and a non-transitory computer readable medium on which is stored machine readable instructions that may cause the processor to identify Internet protocol (IP) addresses and connection attributes associated with the IP addresses. The instructions may also cause the processor to train a machine learning model using the IP addresses as inputs to the machine learning model and connection contexts as outputs of the machine learning model. The machine learning model may learn a first weight matrix corresponding to the IP addresses and a second weight matrix corresponding to the connection contexts. In addition, the connection contexts may be concatenations of the connection attributes associated with a corresponding IP address.

What is claimed is: 
     
       1. An apparatus comprising:
 a processor; and 
 a non-transitory computer readable medium on which is stored instructions that when executed by the processor, are to cause the processor to:
 identify Internet protocol (IP) addresses and connection attributes associated with the IP addresses; and 
 train a machine learning model using the IP addresses as inputs to the machine learning model and connection contexts as outputs of the machine learning model, the machine learning model learning a first weight matrix corresponding to the IP addresses and a second weight matrix corresponding to the connection contexts, wherein the connection contexts comprise concatenations of the connection attributes associated with a corresponding IP address. 
 
 
     
     
       2. The apparatus of  claim 1 , wherein the instructions further cause the processor to:
 learn the first weight matrix and the second weight matrix jointly. 
 
     
     
       3. The apparatus of  claim 1 , wherein the first weight matrix comprises an embedding vector for each of the IP addresses that includes a plurality of first weights in an embedding space. 
     
     
       4. The apparatus of  claim 3 , wherein the second weight matrix comprises an embedding vector for each of the connection contexts that includes a plurality of second weights in the embedding space. 
     
     
       5. The apparatus of  claim 4 , wherein the instructions further cause the processor to:
 determine an error in the machine learning model and change at least one of the plurality of first weights or the plurality of second weights based on the determined error. 
 
     
     
       6. The apparatus of  claim 1 , wherein the instructions further cause the processor to
 identify embedded vectors for each of the IP addresses from the first weight matrix and each of the connection contexts from the second weight matrix; and 
 input the identified embedded vectors to a second machine learning model to determine anomalies in network traffic. 
 
     
     
       7. The apparatus of  claim 1 , wherein, during training of the machine learning model, each IP address input to the machine learning model is input as a one-hot vector having a length corresponding to a number of IP addresses identified and each connection context output from the machine learning model is output as a one-hot vector having a length corresponding to a number of connection contexts. 
     
     
       8. The apparatus of  claim 1 , wherein
 each row of the first weight matrix is an embedding vector corresponding to the IP addresses, and 
 each column of the second weight matrix is an embedding vector corresponding to the connection contexts. 
 
     
     
       9. The apparatus of  claim 1 , wherein the instructions further cause the processor to:
 determine a weighting factor for each of the connection contexts associated with the IP addresses, and 
 apply the weighting factor during training of the machine learning model, wherein the weighting factor for a particular connection context varies proportionally to a frequency in which the particular connection context is associated with a particular IP address, and varies inversely to a number of IP addresses in a network data log associated with the particular connection context, or 
 change a number of training points for the connection contexts based on the weighting factor during training of the machine learning model. 
 
     
     
       10. The apparatus of  claim 1 , wherein the instructions further cause the processor to:
 initialize the first weight matrix in the machine learning model using the identified IP addresses. 
 
     
     
       11. The apparatus of  claim 1 , wherein the instructions further cause the processor to:
 initialize the second weight matrix in the machine learning model using the connection contexts. 
 
     
     
       12. The apparatus of  claim 1 , wherein the connection attributes associated with a connection for each of the IP addresses include at least one of a source port, a destination IP address, a destination port, a protocol, a TCP flag, a timestamp, a number of bytes, or a number of packets. 
     
     
       13. A method comprising:
 identifying, by a processor, Internet protocol (IP) addresses and connection attributes associated with the IP addresses; and 
 training, by the processor, a machine learning model using the IP addresses as inputs to the machine learning model and the connection attributes as outputs of the machine learning model, the machine learning model learning a first embedding corresponding to the IP addresses and a second embedding corresponding to the connection attributes, wherein the connection attributes comprise concatenations of the connection attributes associated with a corresponding IP address, and wherein the first embedding for the IP addresses and the second embedding for the connection attributes are learned jointly. 
 
     
     
       14. The method of  claim 13 , further comprising
 determining a weighting factor for each of the connection attributes associated with the IP addresses, and 
 applying the weighting factor during training of the machine learning model, wherein the weighting factor for a particular connection attribute varies proportionally to a frequency in which the particular connection attribute is associated with a particular IP address, and varies inversely to a number of IP addresses in a network data log associated with the particular connection attribute, or 
 changing a number of training points for the connection attributes based on the weighting factor during training of the machine learning model. 
 
     
     
       15. The method of  claim 13 , wherein training the machine learning model comprises:
 initializing a first weight matrix of the first embedding using the identified IP addresses and initializing a second weight matrix of the second embedding using the connection attributes. 
 
     
     
       16. A non-transitory computer readable medium having computer readable instructions that, when executed by a processor, cause the processor to:
 identify Internet protocol (IP) addresses and flow attributes associated with each of the IP addresses; and 
 train a machine learning model using the IP addresses as inputs to the machine learning model and connection contexts as outputs of the machine learning model, the machine learning model learning first embedded vectors corresponding to the IP addresses and second embedded vectors corresponding to the flow attributes, wherein the flow attributes comprise concatenations of the flow attributes associated with a corresponding IP address. 
 
     
     
       17. The non-transitory computer readable medium of  claim 16 , wherein the instructions further cause the processor to:
 learn the first embedded vectors and the second embedded vectors jointly. 
 
     
     
       18. The non-transitory computer readable medium of  claim 16 , wherein the first embedded vectors form a first embedding matrix and the second embedded vectors form a second embedding matrix, wherein
 each row of the first embedding matrix is one of the first embedded vectors corresponding to an IP address, and 
 each column of the second embedding matrix is one of the second embedding vectors corresponding to a flow attribute. 
 
     
     
       19. The non-transitory computer readable medium of  claim 16 , wherein the instructions further cause the processor to:
 determine a weighting factor for each of the flow attributes associated with the IP addresses, and 
 apply the weighting factor during training of the machine learning model, wherein the weighting factor for a particular flow attribute varies proportionally to a frequency in which the particular flow attribute is associated with a particular IP address, and varies inversely to a number of IP addresses in a network data log associated with the particular flow attribute, or 
 change a number of training points for the flow attributes based on the weighting factor during training of the machine learning model. 
 
     
     
       20. The non-transitory computer readable medium of  claim 16 , wherein the instructions further cause the processor to:
 initialize a first embedding matrix in the machine learning model using the identified IP addresses.